Security your IT team can check.
PeerBie holds your team’s tasks, goals, chat and meetings, and Lucy connects to email, calendars and files. This page shows how we protect that, what has been checked by others, and where your data goes — including the parts that leave the EU.
Security questions: [email protected]
Checked by others
What protects your workspace.
The basics an IT review asks about, and what PeerBie does for each.
SAML single sign-on
People sign in through your identity provider, with your company’s own rules for passwords and devices.
SCIM provisioning
Add and remove people in your identity provider, and PeerBie keeps its member list in step.
Two-step sign-in
Anyone can turn it on with an authenticator app. Workspace admins can require it for every member. It is always required for PeerBie staff.
Short sessions
A sign-in lasts one day and renews for up to 30 days. Signing out of all devices or changing your password ends every session.
Tokens encrypted at rest
The tokens that connect PeerBie to Google and Microsoft are stored encrypted. Data travels encrypted (TLS).
Only the access a feature needs
We ask Google and Microsoft for the narrowest permissions a feature needs, and Microsoft permissions are delegated only: PeerBie acts as the signed-in person.
A person approves first
Lucy asks before she sends an email or deletes a task. AI employees propose work and act only after someone approves, and every AI action is recorded.
Disconnect any time
Remove a Google or Microsoft connection and Lucy loses access. What was derived from your mail and files is deleted (details below).
You see connected apps
Claude, ChatGPT and other assistants you connect are listed under Settings → Connected apps, where one click disconnects them.
Set the rules once for the whole workspace.
Workspace admins decide how people sign in. On Enterprise, connect your identity provider for single sign-on and keep the member list in sync with SCIM.
- Require two-step sign-in for every member, or leave it optional.
- Single sign-on (SAML) and SCIM user sync on the Enterprise plan.
- Approve Microsoft 365 once for your company — see the Microsoft 365 page.
Google and Microsoft data is used for your request only.
When you connect Google or Microsoft, Lucy works with the parts you switch on: mail, calendar and files.
- On request, not in the background. Lucy reads a file when you ask about it. She does not scan or copy your whole drive.
- Disconnect and it is gone. When you disconnect Google, PeerBie revokes its access at Google and deletes what was derived from your mail and files.
- 90 days at most. Anything derived from your mailbox or your files is deleted automatically after 90 days, even if you stay connected.
- No people reading it. No one at PeerBie reads your Google data except with your permission, for security, or where the law requires it.
“We do not sell this data, we do not use it for advertising, and we do not use it to train generalised artificial-intelligence models.”PeerBie Privacy Policy, “Google user data and Limited Use” · Read the policy
“Anything Lucy keeps from a file is deleted when you turn Files off or disconnect the account, and in any case after at most 90 days.”Lucy Privacy Policy, section 11 · Read the policy
Hosted in Germany. AI processing in the US.
PeerBie’s servers and databases are hosted by Hetzner Online GmbH in Germany (EU). Some AI features are processed by providers in the United States, listed below. We would rather tell you plainly than promise EU-only processing.
Stored in Germany (EU)
Your PeerBie workspace
- Account, tasks, goals, chat, posts and files
- Meeting notes and transcripts
- Hosted by Hetzner, Germany
Processed in the US, when you use AI
AI providers
- Google Gemini — Lucy and AI employees
- OpenAI Whisper — voice and audio transcription
- Recall.ai and Deepgram — the meeting note-taker
- ElevenLabs — AI employee voices in Huddles and calls
- Tavily — Lucy’s web search
Sub-processors
| Provider | What it does for PeerBie | Where |
|---|---|---|
| Hetzner | Hosting: servers and storage | Germany (EU) |
| Google LLC (Gemini) | AI for Lucy and AI employees: the messages, tasks and documents you share with Lucy | United States* |
| OpenAI, LLC (Whisper) | Transcription of voice and audio recordings | United States* |
| Recall.ai, Inc. | The meeting note-taker in Zoom, Google Meet and Microsoft Teams, when you turn it on | United States* |
| Deepgram, Inc. | Transcription of the meetings Lucy joins for you | United States* |
| ElevenLabs Inc. | The spoken voice of AI employees in PeerBie Huddles and calls | United States* |
| Tavily | Web search when you ask Lucy to search the web | United States* |
* Our privacy policy: “PeerBie’s servers and databases are hosted by Hetzner Online GmbH in Germany (EU). Some AI features are processed by providers in the United States.” Transfers outside the EU use safeguards such as standard contractual clauses. Google and Microsoft also process your data when you connect your own Google or Microsoft account; that happens under their own terms. Sources: PeerBie Privacy Policy · Lucy Privacy Policy
We don’t use your data to train AI models.
Lucy and AI employees use Google’s Gemini API and OpenAI’s API. We use these providers’ business/API terms, under which your data is not used to train their models.
Read “AI and your data” in our privacy policyUse PeerBie from Claude or ChatGPT with limits you choose.
The PeerBie connector lets an AI assistant read, and if you allow it, update your work. Each person connects their own account.
- It runs as you. Every request uses your own PeerBie permissions, in the one workspace you picked.
- Read only, if you want. Without “read and change” the assistant cannot change anything. There are no delete tools.
- Short-lived access. The assistant’s access token works for one hour. A refresh token not used for 30 days stops working.
- Disconnect in one click. Every token of that connection stops working within a minute.
Sending a security questionnaire?
Send it to us and we will fill it in. The same address takes data-processing questions and reports of a security problem.
[email protected]Buying for a larger team? Talk to us about Enterprise
- Google CASA assessment and OAuth verification (Oct 2026)
- Microsoft verified publisher · PeerBie Inc · Partner ID 6849111
- SAML SSO and SCIM on Enterprise
- Hosted in Germany; AI providers listed above
Security questions, answered.
Has PeerBie been independently assessed?
Yes. PeerBie passed Google’s CASA security assessment in October 2026 for its web and mobile apps, and Google approved its OAuth verification. Microsoft lists PeerBie Inc as a verified publisher (Partner ID 6849111).
Where is our data stored?
PeerBie’s servers and databases are hosted by Hetzner Online GmbH in Germany (EU). Some AI features are processed by providers in the United States: Google (Gemini) for Lucy and AI employees, OpenAI (Whisper) for transcription, Recall.ai and Deepgram for the meeting note-taker, ElevenLabs for AI employee voices and Tavily for web search. We do not promise EU-only processing.
Does PeerBie use our data to train AI?
No. We don’t use your data to train AI models. Lucy and AI employees use Google’s Gemini API and OpenAI’s API under their business/API terms, under which your data is not used to train their models.
Do you support SSO and SCIM?
Yes, on the Enterprise plan: SAML single sign-on through your identity provider, and SCIM to add and remove people automatically.
Can we require two-step sign-in?
Yes. Two-step sign-in with an authenticator app is available to everyone, and workspace admins can require it for every member of the workspace. It is always required for PeerBie staff.
What happens when someone disconnects Google or Microsoft?
Lucy loses access straight away. For Google, PeerBie also revokes its access at Google. What was derived from that person’s mail and files is deleted, and anything derived from mail or files is deleted automatically after 90 days at most.
Which outside providers process our data?
Hetzner (hosting, Germany); Google Gemini, OpenAI Whisper, Recall.ai, Deepgram, ElevenLabs and Tavily (AI, transcription, voices and web search, United States); LiveKit (Huddles audio) and RevenueCat (Lucy app subscriptions). The table on this page has the details.
Do you have SOC 2 or ISO 27001?
We don’t hold SOC 2 or ISO 27001 today. We complete security questionnaires on request — write to [email protected].
Bring your security team. We’ll answer the questions.
Start free and look around, or send us your questionnaire first. Lucy and AI employees come with the Lucy AI add-on, $20 per user a month on Pro and above.
More: Lucy & AI employees · Microsoft 365 · Claude & ChatGPT connector · Privacy policy